This is an automated email from the ASF dual-hosted git repository.
zrlw pushed a commit to branch 3.3
in repository https://gitbox.apache.org/repos/asf/dubbo.git
The following commit(s) were added to refs/heads/3.3 by this push:
new c91027de3d fix: support plaintext PU when AuthPolicy is NONE (#16374)
c91027de3d is described below
commit c91027de3de04090f60af2cc77e962f2a98d78cb
Author: uuuyuqi <[email protected]>
AuthorDate: Fri Jul 10 17:59:27 2026 +0800
fix: support plaintext PU when AuthPolicy is NONE (#16374)
Change-Id: Ic201a42623151d99369a2692b8e8206a2b281007
---
.../netty4/NettyPortUnificationServerHandler.java | 40 ++++-----
.../NettyPortUnificationServerHandlerTest.java | 94 ++++++++++++++++++++++
.../netty4/PortUnificationTestCertProvider.java | 43 ++++++++++
.../org.apache.dubbo.common.ssl.CertProvider | 1 +
4 files changed, 159 insertions(+), 19 deletions(-)
diff --git
a/dubbo-remoting/dubbo-remoting-netty4/src/main/java/org/apache/dubbo/remoting/transport/netty4/NettyPortUnificationServerHandler.java
b/dubbo-remoting/dubbo-remoting-netty4/src/main/java/org/apache/dubbo/remoting/transport/netty4/NettyPortUnificationServerHandler.java
index ce23587b05..7dc3cdc17e 100644
---
a/dubbo-remoting/dubbo-remoting-netty4/src/main/java/org/apache/dubbo/remoting/transport/netty4/NettyPortUnificationServerHandler.java
+++
b/dubbo-remoting/dubbo-remoting-netty4/src/main/java/org/apache/dubbo/remoting/transport/netty4/NettyPortUnificationServerHandler.java
@@ -127,27 +127,29 @@ public class NettyPortUnificationServerHandler extends
ByteToMessageDecoder {
if (providerConnectionConfig != null && canDetectSsl(in)) {
if (isSsl(in)) {
enableSsl(ctx, providerConnectionConfig);
- } else {
- // check server should load TLS or not
- if (providerConnectionConfig.getAuthPolicy() !=
AuthPolicy.NONE) {
- byte[] preface = new byte[in.readableBytes()];
- in.readBytes(preface);
- LOGGER.error(
- CONFIG_SSL_CONNECT_INSECURE,
- "client request server without TLS",
- "",
- String.format(
- "Downstream=%s request without TLS
preface, but server require it. " + "preface=%s",
- ctx.channel().remoteAddress(),
Bytes.bytes2hex(preface)));
-
- // Untrusted connection; discard everything and close the
connection.
- in.clear();
- ctx.close();
- }
+ return;
+ }
+ // check server should load TLS or not
+ if (providerConnectionConfig.getAuthPolicy() != AuthPolicy.NONE) {
+ byte[] preface = new byte[in.readableBytes()];
+ in.readBytes(preface);
+ LOGGER.error(
+ CONFIG_SSL_CONNECT_INSECURE,
+ "client request server without TLS",
+ "",
+ String.format(
+ "Downstream=%s request without TLS preface,
but server require it. " + "preface=%s",
+ ctx.channel().remoteAddress(),
Bytes.bytes2hex(preface)));
+
+ // Untrusted connection; discard everything and close the
connection.
+ in.clear();
+ ctx.close();
+ return;
}
- } else {
- detectProtocol(ctx, url, channel, in);
+ // AuthPolicy.NONE with a non-TLS client: permissive mode, fall
through to
+ // plaintext protocol detection below instead of silently waiting
for more data.
}
+ detectProtocol(ctx, url, channel, in);
}
private void enableSsl(ChannelHandlerContext ctx, ProviderCert
providerConnectionConfig) {
diff --git
a/dubbo-remoting/dubbo-remoting-netty4/src/test/java/org/apache/dubbo/remoting/transport/netty4/NettyPortUnificationServerHandlerTest.java
b/dubbo-remoting/dubbo-remoting-netty4/src/test/java/org/apache/dubbo/remoting/transport/netty4/NettyPortUnificationServerHandlerTest.java
new file mode 100644
index 0000000000..18f2be4e15
--- /dev/null
+++
b/dubbo-remoting/dubbo-remoting-netty4/src/test/java/org/apache/dubbo/remoting/transport/netty4/NettyPortUnificationServerHandlerTest.java
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.remoting.transport.netty4;
+
+import org.apache.dubbo.common.URL;
+import org.apache.dubbo.remoting.ChannelHandler;
+import org.apache.dubbo.remoting.api.ProtocolDetector;
+import org.apache.dubbo.remoting.api.WireProtocol;
+import org.apache.dubbo.remoting.api.pu.ChannelOperator;
+import org.apache.dubbo.remoting.api.ssl.ContextOperator;
+import org.apache.dubbo.rpc.model.ApplicationModel;
+import org.apache.dubbo.rpc.model.FrameworkModel;
+
+import java.util.Collections;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import io.netty.buffer.Unpooled;
+import io.netty.channel.embedded.EmbeddedChannel;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+
+class NettyPortUnificationServerHandlerTest {
+
+ @Test
+ void shouldDetectPlaintextProtocolWhenAuthPolicyIsNone() {
+ AtomicInteger detectCount = new AtomicInteger();
+ FrameworkModel frameworkModel = new FrameworkModel();
+ try {
+ ApplicationModel applicationModel =
frameworkModel.newApplication();
+ URL url =
URL.valueOf("dubbo://127.0.0.1:20880?codec=default&pu.test.cert=true")
+ .setScopeModel(applicationModel);
+ ChannelHandler handler = mock(ChannelHandler.class);
+ WireProtocol protocol = new CountingWireProtocol(detectCount);
+ NettyPortUnificationServerHandler puHandler = new
NettyPortUnificationServerHandler(
+ url,
+ true,
+ Collections.singletonMap("dubbo", protocol),
+ handler,
+ Collections.singletonMap("dubbo", url),
+ Collections.emptyMap());
+ EmbeddedChannel channel = new EmbeddedChannel(puHandler);
+
+ channel.writeInbound(Unpooled.wrappedBuffer(new byte[] {(byte)
0xda, (byte) 0xbb, 0, 0, 0}));
+
+ assertEquals(1, detectCount.get());
+ assertTrue(channel.isOpen());
+ channel.finishAndReleaseAll();
+ } finally {
+ frameworkModel.destroy();
+ }
+ }
+
+ private static final class CountingWireProtocol implements WireProtocol {
+ private final AtomicInteger detectCount;
+
+ private CountingWireProtocol(AtomicInteger detectCount) {
+ this.detectCount = detectCount;
+ }
+
+ @Override
+ public ProtocolDetector detector() {
+ return in -> {
+ detectCount.incrementAndGet();
+ return ProtocolDetector.Result.needMoreData();
+ };
+ }
+
+ @Override
+ public void configServerProtocolHandler(URL url, ChannelOperator
operator) {}
+
+ @Override
+ public void configClientPipeline(URL url, ChannelOperator operator,
ContextOperator contextOperator) {}
+
+ @Override
+ public void close() {}
+ }
+}
diff --git
a/dubbo-remoting/dubbo-remoting-netty4/src/test/java/org/apache/dubbo/remoting/transport/netty4/PortUnificationTestCertProvider.java
b/dubbo-remoting/dubbo-remoting-netty4/src/test/java/org/apache/dubbo/remoting/transport/netty4/PortUnificationTestCertProvider.java
new file mode 100644
index 0000000000..8b237050c8
--- /dev/null
+++
b/dubbo-remoting/dubbo-remoting-netty4/src/test/java/org/apache/dubbo/remoting/transport/netty4/PortUnificationTestCertProvider.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.dubbo.remoting.transport.netty4;
+
+import org.apache.dubbo.common.URL;
+import org.apache.dubbo.common.extension.Activate;
+import org.apache.dubbo.common.ssl.AuthPolicy;
+import org.apache.dubbo.common.ssl.Cert;
+import org.apache.dubbo.common.ssl.CertProvider;
+import org.apache.dubbo.common.ssl.ProviderCert;
+
+@Activate(order = -10000)
+public class PortUnificationTestCertProvider implements CertProvider {
+
+ @Override
+ public boolean isSupport(URL address) {
+ return address.getParameter("pu.test.cert", false);
+ }
+
+ @Override
+ public ProviderCert getProviderConnectionConfig(URL localAddress) {
+ return new ProviderCert(new byte[0], new byte[0], null,
AuthPolicy.NONE);
+ }
+
+ @Override
+ public Cert getConsumerConnectionConfig(URL remoteAddress) {
+ return null;
+ }
+}
diff --git
a/dubbo-remoting/dubbo-remoting-netty4/src/test/resources/META-INF/dubbo/internal/org.apache.dubbo.common.ssl.CertProvider
b/dubbo-remoting/dubbo-remoting-netty4/src/test/resources/META-INF/dubbo/internal/org.apache.dubbo.common.ssl.CertProvider
new file mode 100644
index 0000000000..b764c96c90
--- /dev/null
+++
b/dubbo-remoting/dubbo-remoting-netty4/src/test/resources/META-INF/dubbo/internal/org.apache.dubbo.common.ssl.CertProvider
@@ -0,0 +1 @@
+pu-test-cert=org.apache.dubbo.remoting.transport.netty4.PortUnificationTestCertProvider
